JP4527960B2 - Substitution substitution device, substitution substitution method, substitution substitution program, substitution substitution recording medium - Google Patents

Description

  The present invention relates to substitution substitution processing mainly used in encryption technology, and more particularly to substitution substitution apparatus, substitution substitution method, substitution substitution program, and substitution substitution recording medium for improving calculation efficiency using pre-calculated values. .

An encryption technique is effective for concealing data. Encryption methods include common key encryption and public key encryption. In the common key encryption, the same key is used on the encryption creation side and the encryption / decryption side, and this key is secretly managed. On the other hand, in public key cryptography, the key for ciphertext creation and the key for ciphertext decryption are different. Even if the key for ciphertext creation is disclosed, the key for decryption is found within a realistic time. It is widely believed that it will not be. From the viewpoint of processing speed, the common key encryption is more effective.
In order to create a high-speed and secure common key cipher, a method of dividing data to be encrypted into blocks of an appropriate length and encrypting each block is called block cipher. A representative example of such an encryption method is AES encryption, and its configuration is shown in Non-Patent Document 1, for example.

という形の換字置換が多く用いられている。 Many common key ciphers including this AES cipher are composed of a combination of substitution and permutation. Substitution replacement is a fairly broad concept, but in recent years due to the demands of software implementation,

Substitution substitution of the form is often used.

と表される置換行列である。つまり、換字関数による演算を換字と考え、置換行列との積を置換と考える。 All calculations here are performed on the ring R. S _j (x) (j = 1, 2,..., N) is an R → R substitution function (S-box), and P is

Is a permutation matrix. That is, an operation based on a substitution function is considered as substitution, and a product with a substitution matrix is considered as substitution.

で示される関数ＳＰ_ｊの出力値を計算し、その事前計算結果をメモリ等に格納しておくことにより、式（１）を効率的に計算する方法も示されている。 The substitution substitution shown in Expression (1) is also used in the SHARK encryption defined in Non-Patent Document 2. Furthermore, in this non-patent document 2,

Also shown is a method for efficiently calculating the expression (1) by calculating the output value of the function SP _j shown in FIG.

ｓ₂（ｘ）＝ｓ₅（ｘ）
ｓ₃（ｘ）＝ｓ₆（ｘ） …(5)
ｓ₄（ｘ）＝ｓ₇（ｘ）
ｓ₈（ｘ）＝ｓ₁（ｘ）
となっている。 In addition, substitution values used in actual block ciphers are not limited to {p _ij }, s _j (x), which are generally described as shown in Equation (1), but these values are limited. Many of them are made up of shapes. For example, in E2 encryption (for example, see Non-Patent Document 3) and Camellia encryption (for example, see Non-Patent Document 4), p _ij ε {0,1}, and between s _j (x) There is a simple mathematical relationship. In fact, in Camellia encryption, R = GF (2 ⁸ ), n = m = 8,

s ₂ (x) = s ₅ (x)
s ₃ (x) = s ₆ (x) (5)
s ₄ (x) = s ₇ (x)
s ₈ (x) = s ₁ (x)
It has become.

Non-Patent Document 4 introduces a method of calculating Equation (1) more efficiently than the general method shown in Equation (3) for Camellia encryption having such special properties. Hereinafter, the case where the method of this nonpatent literature 4 is implement | achieved using a 64-bit processor is demonstrated.
In this method, the output value of s _j (x) is pre-calculated for j = 1, 2, 3, 4 and x = (00000000) ₂ to (11111111) ₂ , and the operation result s _j is _divided into eight elements. Arranged 8KB (= 8 bytes (64 bits) × 256 × 4) bit string (table)
_SPj = ( _sj , _sj , _sj , _sj , _sj , _sj , _sj , _sj ) (6)
Is stored in memory. Then, in the substitution processing, the table of the equation (6) is referred to, and the value of SP _j corresponding to the input data string (x ₁ , x ₂ ,..., X ₈ ) is applied to the equation (5). further by applying equation (2) and matrix (4), the input data sequence _{(x 1, x 2, ...} , x 8) the substitution substitution results _{(y 1, y 2, ...} , y 8) calculated To do. The number of processes required for this calculation and the size of the table are shown below.
Table reference count 8
Exclusive OR number 7
Number of logical products 8
Table size (KB) 8

Next, the case where the method of this nonpatent literature 4 is implement | achieved using a 32-bit processor is demonstrated.
In this case, the output value of s _j (x) is pre-calculated for j = 1, 2, 3, 4 and x = (00000000) ₂ to (11111111) ₂ , and the operation result s _j is expressed as follows: The arranged 4 KB (= 4 bytes (32 bits) × 256 × 4) table is stored in the memory.

を計算し、入力データ列（ｘ_１,ｘ_２,…,ｘ_８）の換字置換結果（ｙ_１,ｙ_２,…,ｙ_８）を算出する。なお、ＳＰ_１１１０（ｘ_８）は、（ｓ_１（ｘ_８）,ｓ_１（ｘ_８）,ｓ_１（ｘ_８）,０）を示し、その演算値は、事前計算された式（７）の表から抽出されるものである。その他のＳＰ_０２２２（ｘ_５）等についても同様である。また、「≫_８」は、ＧＦ（２^８）をＧＦ（２）^８と同一視した場合における８ビット右循環シフトを表す。 SP ₁₁₁₀ = (s ₁ , s ₁ , s ₁ , 0)
SP ₀₂₂₂ = (0, s ₂ , s ₂ , s ₂ ) (7)
SP ₃₀₃₃ = (s ₃ , 0, s ₃ , s ₃ )
SP ₄₄₀₄ = (s ₄ , s ₄ , 0, s ₄ )
And in the substitution processing, it was shown in the nonpatent literature 5 with reference to the table | surface of this Formula (7).

Was calculated, the input data sequence _{(x 1, x 2, ...} , x 8) the substitution substitution results _{(y 1, y 2, ...} , y 8) is calculated. Note that SP ₁₁₁₀ (x ₈ ) indicates (s ₁ (x ₈ ), s ₁ (x ₈ ), s ₁ (x ₈ ), 0), and the calculated value thereof is calculated in advance using Equation (7) It is extracted from the table. The same applies to the other SP ₀₂₂₂ (x ₅ ) and the like. “>> ₈ ” represents an 8-bit right circular shift when GF (2 ⁸ ) is identified with GF (2) ⁸ .

In the following, the number of processes and the size of the table necessary for the calculation of equation (8) are shown.
Table reference count 8
Exclusive OR number 8
32-bit data cyclic shift count 1
Table size (KB) 4
Specification for the ADVANCED ENCRYPTION STANDARD (AES), Federal Information Processing Standards Publication 197 V. Rijmen, et al .: “The Cipher SHARK,” Fast Software Encryption-Third International Workshop, Lecture Notes in Computer Science 1039, pp. 99-111, Springer-Verlag, 1996 M. Kanda, et al: “E2-A New 128-Bit Block Cipher,” IEICE Transactions on Fundamentals, Vol. E83-A, No. 1, pp. 48-59, 2000 K. Aoki, et al: “The 128-Bit Block Cipher Camellia,” IEICE Transactions on Fundamentals, Vol. E85-A, No. 1, pp. 11-24, 2002 Kazuma Aoki, 6 others, "Implementation evaluation of 128-bit block cipher Camellia", IEICE Technical Report, IEICE, September 29, 2000, ISEC 2000-73, p. 131-138

However, the method shown in Non-Patent Document 5 has a problem that it cannot be applied when the size of the table to be stored in the memory is large and sufficient memory capacity cannot be secured.
The present invention has been made in view of these points, and an object of the present invention is to provide a substitution device that can perform substitution substitution efficiently even when a sufficient memory capacity cannot be secured.
Another object of the present invention is to provide a substitution method capable of performing substitution substitution efficiently even when a sufficient memory capacity cannot be secured.

Furthermore, another object of the present invention is to provide a substitution program for causing a computer to execute a function capable of efficiently performing substitution substitution even when a sufficient memory capacity cannot be secured.
Another object of the present invention is to provide a substitution-replacement recording medium storing a substitution-replacement program for causing a computer to execute a function capable of performing substitution substitution efficiently even when a sufficient memory capacity cannot be secured. Is to provide.

In the present invention, in order to solve the above problem, the bit string SP is stored in the memory. Here, the bit string SP is obtained by substituting a possible value of x into a function SP (x) in which a plurality of functions s (x) having the same value as any substitution function s _j (x) is arranged by a cyclic shift. It is. Then, in the substitution processing, this bit string SP is extracted from the memory, the entire extracted bit string is cyclically shifted, and the result of substituting the input data x _j for any substitution function s _j (x) is s _j (x _j ) Are arranged, a bit string SP _j (x _j ) is calculated.
The calculated bit string SP _j (x _j ) is applied to, for example, the method of Non-Patent Document 4, and is thus a substitution substitution result from the input data string (x ₁ , x ₂ ,..., X _n ). A data string (y ₁ , y ₂ ,..., Y _m ) is obtained.

Here, since the extracted bit string can be cyclically shifted to calculate the bit string SP _j necessary for the substitution substitution operation, the number of bit strings SP _j to be stored in the memory can be reduced.
The function s (x) is equivalent to any substitution function s _j (x) by its own cyclic shift (s _j (x) = s (x) << _r ). In this case, the result of cyclically shifting the entire bit string SP = (s (x), s (x),..., S (x)) in which a plurality of functions s (x) are arranged in the same bit and in the same direction is The bit string SP _j = (s _j (x), s _j (x),..., S _j (x)) in which the same number of substitution functions s _j (x) are arranged has the property of being equivalent ((s _j ( x), s _j (x),..., s _j (x)) = (s (x), s (x),..., s (x)) << _r ). Therefore, when the bit string SP _j necessary for the substitution substitution operation is calculated, the substitution function s _j (x) is calculated from the function s (x), and a plurality of the substitution functions s _j (x) calculated are arranged to form the bit string SP. _The bit string SP _j can be generated simply by cyclically shifting the entire bit string SP without performing complicated processing such as generating _j .

Note that “<< _r ” represents an r-bit left cyclic shift, and “>> _r ” represents an r-bit right cyclic shift. Here, GF ( ^2α ) is identified with GF (2) ^α .

As described above, according to the present invention, the number of bit strings SP _j to be stored in the memory can be reduced. Therefore, even when a sufficient memory capacity cannot be secured, the substitution method can be efficiently performed using the method of Non-Patent Document 4. A replacement operation can be performed.
Also, merely for the entire bit string SP can generate a bit string SP _j only cyclic shift, logical operands also less required to generate a bit string SP _j, can realize efficient substitution substitution operation.

Embodiments of the present invention will be described below with reference to the drawings.
[First Embodiment]
First, a first embodiment of the present invention will be described.
This embodiment is an example in which the present invention is applied to a substitution substitution process of Camellia encryption performed in a 64-bit processor.
FIG. 1 is a diagram illustrating a functional configuration of the substitution device 10 according to the present embodiment, FIG. 2 is a diagram illustrating a data configuration of a table 20 stored in the bit string storage unit 11, and FIG. It is the figure which illustrated hardware constitutions. FIG. 4 is a flowchart for explaining the substitution substitution method in this embodiment. Hereinafter, the configuration and processing procedure of the substitution device 10 of this example will be described with reference to these drawings.

<Hardware configuration>
As illustrated in FIG. 3, the substitution device 10 of this example stores a 64-bit CPU (Central Processing Unit) 10a, a ROM (Read Only Memory) 10b, a RAM (Random Access Memory) 10c, and a substitution substitution program. A program memory 10d such as a RAM, an input unit 10e as an interface, and an output unit 10f are connected to each other via a bus 10g so as to communicate with each other. Then, the CPU 10a reads the substitution replacement program stored in the program memory 10d and executes the processing according to the program, thereby realizing each processing function shown below.

によって、入力データ列（ｘ_１,ｘ_２,…,ｘ_ｎ）からデータ列（ｙ_１,ｙ_２,…,ｙ_ｍ）を求める装置である。なお、ｐ_ij（ｉ＝１,２,…,ｍ、ｊ＝１,２,…,ｎ）は、Ｒ上の置換行列Ｐのｉ行ｊ列要素を示し、ｓ_ｊ（ｘ）は、Ｒ→Ｒの換字関数（Ｓ箱：S-box）を示す。
ここではＣａｍｅｌｌｉａ暗号の換字置換処理を例にとるため、Ｒ＝ＧＦ（２^８）、ｎ＝ｍ＝８であり、置換行列は、

である。
また、Ｃａｍｅｌｌｉａ暗号の場合、換字関数間には、
ｓ₂（ｘ）＝ｓ₅（ｘ）＝ｓ₁（ｘ）≪_１
ｓ₃（ｘ）＝ｓ₆（ｘ）＝ｓ₁（ｘ）≫_１ …(10)
ｓ₄（ｘ）＝ｓ₇（ｘ）＝ｓ₁（ｘ≪_１）
ｓ₈（ｘ）＝ｓ₁（ｘ）
の関係がある。 <Premise>
The substitution device 10 is a substitution substitution on the ring R.

Is a device for obtaining a data string (y ₁ , y ₂ ,..., Y _m ) from an input data string (x ₁ , x ₂ ,..., X _n ). Note that p _ij (i = 1, 2,..., M, j = 1, 2,..., N) indicates i row and j column elements of the permutation matrix P on R, and s _j (x) is R → Indicates the R substitution function (S-box).
Here, since substitution substitution processing of Camellia encryption is taken as an example, R = GF (2 ⁸ ), n = m = 8, and the substitution matrix is

It is.
In the case of Camellia encryption, between substitution functions,
s ₂ (x) = s ₅ (x) = s ₁ (x) << ₁
s ₃ (x) = s ₆ (x) = s ₁ (x) >> ₁ (10)
s ₄ (x) = s ₇ (x) = s ₁ (x << ₁ )
s ₈ (x) = s ₁ (x)
There is a relationship.

<Pretreatment>
First, as preprocessing, the pre-calculated bit string SP is stored in the bit string storage unit 11. Here, in the bit string SP, a function that is equivalent to any substitution function s _j (x) by a cyclic shift is defined as s (x), and a function in which a plurality of the functions s (x) are arranged is defined as SP (x). , A bit string obtained by substituting a possible value of x into the function SP (x). In this example, the substitution function s ₁ (x) is assumed to be a function s (x).
Further, as illustrated in FIG. 2, in this example, a function in which the function s (x) is arranged in eight elements is expressed as SP (x) (= (s (x), s (x), s (x), s (X), s (x), s (x), s (x), s (x))). Then, a 256-element bit string 22 obtained by substituting x = (00000000) ₂ , (00000001) ₂ ,..., (11111111) ₂ for the function SP (x), respectively.
SP ((00000000) ₂ ) = (s ((00000000) ₂ ),…, s ((00000000) ₂ ))
SP ((00000001) ₂ ) = (s ((00000001) ₂ ),…, s ((00000001) ₂ ))
...
SP ((11111111) ₂ ) = (s ((11111111) ₂ ), ..., s ((11111111) ₂ ))
Table 20 is constituted by SP.

In addition, each of these bit strings SP ((00000000) ₂ ), SP ((00000001) ₂ ),..., SP ((11111111) ₂ ) has an assigned value x = (00000000) ₂ , (00000001) ₂ ,. (11111111) ₂ is associated with each. In this example, each bit string SP ((00000000) ₂ ), SP ((00000001) ₂ ) that is the result of substitution of x is stored in the address 21 (H (x)) of the bit string storage unit 11 corresponding to each substitution value x. ,..., SP ((11111111) ₂ ) is stored to perform this association.

が格納される。この例では式（９）に示す置換行列Ｐを格納しておく。 Since the substitution result of s (x) is 8 bits, each substitution result of SP (x) in which 8 elements are arranged is 64 (8 × 8) bits = 8 bytes. Table 20 is a set of 256 elements of the assignment result to SP (x). Therefore, the size (data size) of Table 20 is 2 KB (= 8 bytes × 256).
Also, the permutation matrix storage unit 16 has a permutation matrix

Is stored. In this example, a permutation matrix P shown in Expression (9) is stored.

<Substitution replacement processing>
When performing substitution substitution processing in this embodiment, first, the data string input unit 12 accepts input of an input data string (x ₁ , x ₂ ,..., X ₈ ) that is the subject of substitution substitution processing (step S1). The input data x ₄ and x ₇ are sent to the 8-bit cyclic shift unit 13, and the other data sequences (x ₁ , x ₂ , x ₃ , x ₅ , x ₆ , x ₈ ) are sent to the bit sequence extraction unit 14. It is done.

The 8-bit cyclic shift unit 13 performs a 1-bit left cyclic shift (x ₄ << ₁ , x ₇ << ₁ ) on the transmitted 8-bit data x ₄ and x ₇ (step S2). That is, for example, when each bit of _{x 4} is Abcdefjh, the bit string so that the Bcdefjha, to 1-bit rotation each bit to the left. These 1-bit left circular shift results (x ₄ << ₁ , x ₇ << ₁ ) are sent to the bit string extraction unit 14.
The bit string extraction unit 14 refers to the bit string storage unit 11 and sends the data string (x ₁ , x ₂ , x ₃ , x ₅ , x ₆ , x ₈ ) and the left circular shift result (x ₄ << ₁ , x ₇ << ₁ ) The bit string SP (x ₁ ), SP (x ₂ ), SP (x ₃ ), SP (x ₅ ), SP (x ₆ ), SP (x ₈ ), SP (x ₄ << ₁ ), and SP (x ₇ << ₁ ) are extracted (step S3).

Here, SP (x ₁ ) extracted by the bit string extraction unit 14 is SP ₁ (x ₁ ), SP (x ₈ ) is SP ₈ (x ₈ ), and SP (x ₄ << ₁ ) is SP ₄ (x ₄ ), SP (x ₇ << ₁ ) is sent to the AND unit 17 as SP ₇ (x ₇ ). SP _j (α) is a bit string (s _j (α), s _j (α), s _j () obtained by arranging eight s _j (α) as a result of substituting data α for the substitution function s _j (x). α), s _j (α), s _j (α), s _j (α), s _j (α), s _j (α)). Further, the replacement (SP ₁ (x ₁ ) ← SP (x ₁ ), SP ₈ (x ₈ ) ← SP (x ₈ ), etc.) as described above can be performed in this example as a substitution function s ₁ (x ) Is a function s (x), and is based on the fact that the relationship of Expression (10) is established.

The other SP (x ₂ ), SP (x ₃ ), SP (x ₅ ), and SP (x ₆ ) extracted by the bit string extraction unit 14 are sent to the 64-bit cyclic shift unit 15.
The 64-bit cyclic shift unit 15 (corresponding to “circular shift means”) cyclically shifts the entire transmitted bit string SP (x ₂ ) by 1 bit to the left (SP (x ₂ ) << ₁ ), and the substitution function s ₂ A bit string SP ₂ (x ₂ ) in which eight results s ₂ (x ₂ ) are arranged as a result of substituting the input data x ₂ into (x) is calculated. Here, the reason why the entire bit string SP (x ₂ ) is cyclically shifted to the left by 1 bit to form the bit string SP ₂ (x ₂ ) will be described.

For example, when each bit of s (x ₂ ) is abcdefjh, SP (x ₂ ) becomes (abcdefjhabcdefjh... Abcdefjh), and the entire SP (x ₂ ) is cyclically shifted by 1 bit to the left (SP (x ₂ ) << ₁ )
(Bcdefjhabcdefjh ... abcdefjha) (11)
It becomes.
Further, as described above, in this example, s (x) = s ₁ (x) is set, and further, s ₂ (x ₂ ) = s ₁ (x ₂ ) << ₁ = s (x ₂ ) from Expression (10). ) << ₁ is established. Therefore, s ₂ (x ₂ ) is bcdefjha which is the same as the result (s (x ₂ ) << ₁ ) obtained by cyclically shifting s (x ₂ ) by 1 bit to the left. Then, s _{2 (x 2)} bit string _SP 2 was eight sequences _{(x 2)} is equal to the (bcdefjhabcdefjh ... abcdefjha), and the above (11). This bit string SP _{(x 2)} by one bit the whole left circular shift result _{(SP (x 2) «1} ) _is, s _{2 (x} 2) eight sequence bit string _SP 2 and _{(x 2)} It means to be equal.

Similarly, the 64-bit cyclic shift unit 15 cyclically shifts the entire transmitted bit string SP (x ₅ ) by 1 bit to the left (SP (x ₅ ) << ₁ ), and the entire SP (x ₃ ) and SP ( x ₆ ) is cyclically shifted by 1 bit to the right respectively (SP (x ₃ ) >> ₁ , SP (x ₆ ) >> ₁ ), and bit strings SP ₅ (x ₅ ), SP ₃ (x ₃ ), SP ₆ ( x ₆ ) is calculated (step S4). Then, the bit strings SP ₂ (x ₂ ), SP ₃ (x ₃ ), SP ₅ (x ₅ ), SP ₆ (x ₆ ) calculated by the 64-bit cyclic shift unit 15 are sent to the AND operation unit 17.

を算出する（ステップＳ５）。算出された論理積ＳＰ_ｊ（ｘ_ｊ）・Ｐ_ｊ（ｊ＝１，２，…，８）は、排他的論理和演算部１８に送られ、そこで、これらの論理積ＳＰ_ｊ（ｘ_ｊ）・Ｐ_ｊの排他的論理和

が求められ（ステップＳ６）、その演算結果のデータ列（ｙ_１,ｙ_２,…,ｙ_８）が換字置換結果として出力される（ステップＳ７）。 The AND operation unit 17 performs the j column element of the permutation matrix P from the permutation matrix storage unit 16 for the sent SP _j (x _j ).

Is calculated (step S5). The calculated logical product SP _j (x _j ) · P _j (j = 1, 2,..., 8) is sent to the exclusive OR operation unit 18, where these logical products SP _j (x _j )・ Exclusive OR of P _j

Is obtained (step S6), and a data string (y ₁ , y ₂ ,..., Y ₈ ) of the operation result is output as a substitution substitution result (step S7).

<Calculation cost / table size>
As described above, in this embodiment, the cyclic shift of the 8-bit data is performed twice in step S2, and the table 20 of the bit string storage unit 11 is referred to eight times in step S3. In step S4, 64-bit data is cyclically shifted four times. In step S5, the logical product _SPj ( _xj ) _.Pj (j = 1, 2,..., 8) is performed eight times. The exclusive OR is performed 7 times. As described above, the size of Table 20 is 2 KB.

Table reference count 8
Exclusive OR number 7
64-bit data cyclic shift count 4
8-bit data cyclic shift count 2
Number of logical products 8
Table size (KB) 2
Thus, in this embodiment, the size of the table could be reduced to a quarter of the conventional size without increasing the calculation cost so much.

[Second Embodiment]
Next, a second embodiment of the present invention will be described.
This embodiment is an example in which the present invention is applied to a substitution substitution process of Camellia encryption performed in a 32-bit processor.
5 is a diagram illustrating a functional configuration of the substitution device 100 according to the present embodiment, FIG. 6 is a diagram illustrating a data configuration of the table 130 stored in the bit string storage unit 111, and FIG. 7 is a substitution substitution according to the embodiment. It is a flowchart for demonstrating a method. Hereinafter, the configuration and processing procedure of the substitution device 100 of this example will be described with reference to these drawings. In the following description, differences from the first embodiment will be mainly described, and description of items common to the first embodiment will be omitted.

<Hardware configuration>
The second embodiment is the same as the first embodiment except that a 32-bit CPU is used.
<Pretreatment>
As in the first embodiment, the pre-calculated bit string SP is stored in the bit string storage unit 111. However, in this example, a function in which the function s (x) is arranged in four elements is SP (x) (= (s (x), s (x), s (x), s (x))). A bit string 132 of 256 elements obtained by substituting x = (00000000) ₂ , (00000001) ₂ ,... (11111111) ₂ for SP (x), respectively.
SP ((00000000) ₂ ) = (s ((00000000) ₂ ),…, s ((00000000) ₂ ))
SP ((00000001) ₂ ) = (s ((00000001) ₂ ),…, s ((00000001) ₂ ))
...
SP ((11111111) ₂ ) = (s ((11111111) ₂ ), ..., s ((11111111) ₂ ))
Table 130 is configured (FIG. 6).

Further, similarly to the first embodiment, in this example, each bit string SP ((00000000) ₂ that is the result of substitution of x into the address 131 (H (x)) of the bit string storage unit 111 corresponding to each substitution value x. ), SP ((00000001) ₂ ),..., SP ((11111111) ₂ ), thereby associating each bit string SP with each substitution value x.
Since the substitution result of s (x) is 8 bits, each substitution result of SP (x) in which four elements are arranged is 32 (8 × 4) bits = 4 bytes. Table 130 is a set of 256 elements obtained by substituting this SP (x). Therefore, the size (data size) of this table 130 is 1 KB (= 4 bytes × 256).
Further, in the constant storage unit 116, corresponding to j = the associated constants _{1,8 (ffffff00) 16, j =} 2,5 in the associated constants _{(00ffffff) 16,} j = 3,6 constant _{(ff00ffff) 16,} j = 4,7 in the associated constants _{(ffff00ff) 16} is stored.

<Substitution replacement processing>
When performing substitution substitution processing in this embodiment, first, the data string input unit 112 receives input of an input data string (x ₁ , x ₂ ,..., X ₈ ) to be subjected to substitution substitution processing (step S11). The input data x ₄ and x ₇ are sent to the 8-bit cyclic shift unit 113, and the other data strings (x ₁ , x ₂ , x ₃ , x ₅ , x ₆ , x ₈ ) are sent to the bit string extraction unit 114. It is done.
The 8-bit cyclic shift unit 113 performs a 1-bit left cyclic shift (x ₄ << ₁ , x ₇ << ₁ ) on the transmitted 8-bit data x ₄ and x ₇ (step S12), and performs an operation thereof. The result is sent to the bit string extraction unit 114.

The bit string extraction unit 114 refers to the bit string storage unit 111, and transmits the transmitted data string (x ₁ , x ₂ , x ₃ , x ₅ , x ₆ , x ₈ ) and the left circular shift result (x ₄ << ₁ , x ₇ << ₁ ) The bit string SP (x ₁ ), SP (x ₂ ), SP (x ₃ ), SP (x ₅ ), SP (x ₆ ), SP (x ₈ ), SP (x ₄ << ₁ ), and SP (x ₇ << ₁ ) are extracted (step S13). SP (x ₁ ), SP (x ₈ ), SP (x ₄ << ₁ ), and SP (x ₇ << ₁ ) extracted by the bit string extraction unit 114 are respectively sent to the AND operation unit 117, SP (x ₂ ), SP (x ₃ ), SP (x ₅ ), and SP (x ₆ ) are each sent to the 32-bit cyclic shift unit 115.

The 32-bit cyclic shift unit 115 (corresponding to “circular shift means”) cyclically shifts the entire transmitted bit string SP (x ₂ ) and SP (x ₅ ) to the left by 1 bit (SP (x ₂ ) << ₁ , SP (x ₅ ) << ₁ ), SP (x ₃ ) and SP (x ₆ ) are each cyclically shifted to the right by one bit (SP (x ₃ ) >> ₁ , SP (x ₆ ) >> ₁ (Step S14). Then, these calculation results are sent to the logical product calculation unit 117. SP (x ₂ ) << ₁ corresponds to a bit string in which four results s ₂ (x ₂ ) obtained by substituting the input data x ₂ into the substitution function s ₂ (x) are arranged. Similarly, SP (x ₅ ) << ₁ corresponds to a bit string in which four s ₅ (x ₅ ) are arranged, and SP (x ₃ ) >> ₁ , corresponds to a bit string in which four s ₃ (x ₃ ) are arranged. SP (x ₆ ) >> ₁ corresponds to a bit string in which four s ₆ (x ₆ ) are arranged.

The logical product operation unit 117 sends the received SP (x _j ) (j = 1,8), SP (x _j ) << ₁ (j = 2,5), SP (x _j ) >> ₁ (j = 3, 6) and constants ((ffffff00) ₁₆ etc.) respectively corresponding to j of SP (x _j << ₁ ) (j = 4, 7) are extracted from the constant storage unit 116, and the extracted constants and SP (x _j ) and Is calculated as follows (step S15).
SP ₁₁₁₀ (x ₁ ) ← SP (x ₁ ) & (ffffff00) ₁₆
SP ₀₂₂₂ (x ₂ ) <-SP (x ₂ ) << ₁ & (00ffffff) ₁₆
SP ₃₀₃₃ (x ₃ ) <-SP (x ₃ ) >> ₁ & (ff00ffff) ₁₆
SP ₄₄₀₄ (x ₄ ) <-SP (x ₄ << ₁ ) & (ffff00ff) ₁₆
SP ₀₂₂₂ (x ₅ ) ← SP (x ₅ ) << ₁ & (00ffffff) ₁₆
SP ₃₀₃₃ (x ₆ ) <-SP (x ₆ ) >> ₁ & (ff00ffff) ₁₆
SP ₄₄₀₄ (x ₇ ) ← SP (x ₇ << ₁ ) & (ffff00ff) ₁₆
SP ₁₁₁₀ (x ₈ ) ← SP (x ₈ ) & (ffffff00) ₁₆
Calculation results SP ₁₁₁₀ (x ₁ ), SP ₀₂₂₂ (x ₂ ), SP ₃₀₃₃ (x ₃ ), SP ₄₄₀₄ (x ₄ ), SP ₀₂₂₂ (x ₅ ), SP ₃₀₃₃ (x ₆ ) in the AND operation unit 117 , SP ₄₄₀₄ (x ₇ ), SP ₁₁₁₀ (x ₈ ) are sent to the exclusive OR operation unit 118, and the exclusive OR operation unit 118 obtains D and U by the following exclusive OR operation ( Step S16).

算出されたＤは排他的論理和演算部１２０に送られ、Ｕは３２ビット循環シフト部１１９及び排他的論理和演算部１２０に送られる。３２ビット循環シフト部１１９は、送られたＵを右に８ビット循環シフトして（Ｕ≫_８）排他的論理和演算部１２０に送り（ステップＳ１７）、排他的論理和演算部１２０は、以下の演算によりデータ列（ｙ_１,ｙ_２,…,ｙ_８）を算出し（ステップＳ１８）、そのデータ列（ｙ_１,ｙ_２,…,ｙ_８）を換字置換結果として出力する（ステップＳ１９）。

The calculated D is sent to the exclusive OR operation unit 120, and U is sent to the 32-bit cyclic shift unit 119 and the exclusive OR operation unit 120. The 32-bit cyclic shift unit 119 cyclically shifts the sent U by 8 bits to the right (U >> ₈ ) and sends it to the exclusive OR operation unit 120 (step S17). The data string (y ₁ , y ₂ ,..., Y ₈ ) is calculated by the operation of (Step S18), and the data string (y ₁ , y ₂ ,..., Y ₈ ) is output as a substitution substitution result (Step S19). ).

＜計算コスト・表の大きさ＞
以上説明したように、本形態では、ステップＳ１２において、８ビットデータの循環シフトを２回行い、ステップＳ１３において、ビット列格納部１１１の表１３０を８回参照している。また、３２ビットデータの循環シフトを、ステップＳ１４において４回行い、ステップＳ１７において１回行っている。さらに、スステップＳ１５において論理積を８回行い、排他的論理和をステップＳ１６において６回、ステップＳ１８において２回行っている。また、前述のように表１３０の大きさは１ＫＢである。

<Calculation cost / table size>
As described above, in this embodiment, the cyclic shift of 8-bit data is performed twice in step S12, and the table 130 of the bit string storage unit 111 is referred to eight times in step S13. Further, the cyclic shift of 32-bit data is performed four times in step S14 and once in step S17. Furthermore, logical product is performed 8 times in step S15, and exclusive logical sum is performed 6 times in step S16 and twice in step S18. Further, as described above, the size of the table 130 is 1 KB.

Table reference count 8
Exclusive OR number 8
32-bit data cyclic shift count 5
8-bit data cyclic shift count 2
Number of logical products 8
Table size (KB) 1
Thus, in this embodiment, the size of the table could be reduced to a quarter of the conventional size without increasing the calculation cost so much.

The present invention is not limited to the embodiments described above. For example, since each of the above-described embodiments is an application example to the Camellia cipher, R = GF (2 ⁸ ), n = m = 8, the permutation matrix P is set as Formula (9), and the formula ( 10), but is not particularly limited to this. For example, another extension field of GF (2) is used as R, other numbers are applied as n and m, and a permutation matrix P may be another matrix in which each element is ∈ {0, 1}, and s _j (x) = s (e (x)) << _t (e is a function that can be easily calculated) as a substitution function Those satisfying the relationship may be used. Further, when it is not necessary to perform a cyclic shift or when the efficiency is poor, instead of this cyclic shift, an operation combining a normal shift, addition, exclusive logical sum, logical sum or the like may be performed.

In each of the above-described embodiments, the bit string (SP) configured only from the result of substituting the possible values of x into one type of function s (x) is stored in the bit string storage unit. Alternatively, a bit string (SP) composed of the result of substituting the possible values of x into a plurality of functions s (x) may be stored in the bit string storage unit, and substitution substitution processing may be performed using these.
Further, in each of the above-described embodiments, the substitution function s ₁ (x) is used as the function s (x). However, other substitution functions may be used as the function s (x). The function may be a function s (x).

Needless to say, other modifications are possible without departing from the spirit of the present invention. In addition, the various processes described above are not only executed in time series according to the description, but may be executed in parallel or individually according to the processing capability of the apparatus that executes the processes or as necessary.
Further, when the above configuration is realized by a computer, the processing contents of the functions that each device should have are described by a program (substitution conversion program). The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded in a computer-readable recording medium (substitution conversion recording medium). The computer-readable recording medium may be any medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, or a semiconductor memory. Specifically, for example, the magnetic recording device may be a hard disk device or a flexible Discs, magnetic tapes, etc. as optical disks, DVD (Digital Versatile Disc), DVD-RAM (Random Access Memory), CD-ROM (Compact Disc Read Only Memory), CD-R (Recordable) / RW (ReWritable), etc. As the magneto-optical recording medium, MO (Magneto-Optical disc) or the like can be used, and as the semiconductor memory, EEP-ROM (Electronically Erasable and Programmable-Read Only Memory) or the like can be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from the portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

  Since the present invention can greatly reduce the size of a table required for substitution substitution operation (for example, 1/4 in a 32-bit word length environment), substitution in a memory-saving environment such as a mobile phone does not significantly reduce the computation speed. You can implement replacement.

The figure which illustrated the functional composition of the substitution substitution device in a 1st embodiment. The figure which illustrated the data structure of the table | surface stored in the bit string storage part of 1st Embodiment. The figure which illustrated the hardware constitutions of the substitution device. The flowchart for demonstrating the substitution substitution method of 1st Embodiment. The figure which illustrated the functional composition of the substitution substitution device in a 2nd embodiment. The figure which illustrated the data structure of the table | surface stored in the bit string storage part of 2nd Embodiment. The flowchart for demonstrating the substitution substitution method of 2nd Embodiment.

Explanation of symbols

10,100 Substitution replacement device 11,111 Bit string storage unit 14,114 Bit extraction unit 15 64-bit cyclic shift unit 115,119 32-bit cyclic shift unit

Claims (7)

i = 1,2, ..., m, j = 1,2, ..., n, i row j column element of the permutation matrix on ring R is p _ij, and R → R substitution function is s _j (x ), Substitution substitution on R

Is a substitution device for obtaining a data string (y ₁ , y ₂ ,..., Y _m ) from an input data string (x ₁ , x ₂ ,..., X _n ),
A function that has the same value as any of the substitution functions s _j (x) by the cyclic shift is defined as s (x), a function in which a plurality of the functions s (x) are arranged is defined as SP (x), and this function SP (x ), A bit string storage means for storing the bit string SP when the bit string obtained by substituting a possible value of x is SP,
Bit string extraction means for extracting at least part of the bit string SP from the bit string storage means;
The entire bit string extracted by the bit string extraction means is cyclically shifted, and the result of substituting the input data x _j for any of the substitution functions s _j (x) is a bit string SP _j (array of a plurality of s _j (x _j ). a cyclic shift means for calculating x _j );
Substitution replacement device characterized by having. A substitution device according to claim 1,
The function s (x) is
Any substitution function s _k (x),
The substitution device characterized by that. A substitution device according to claim 1 or 2,
The bit string extraction means includes
A means for extracting a bit string SP (x _p ) corresponding to any of the input data x _p ;
The substitution device characterized by that. The substitution device according to any one of claims 1 to 3,
The bit string SP stored in the bit string storage means is
A bit string composed only of the result of substituting a possible value of x into one type of the function s (x),
The substitution device characterized by that. Let the computer function as a substitution substitution device having a memory, a bit string extraction means, and a cyclic shift means, i = 1, 2,..., M, j = 1, 2,. Substitution substitution on R in the case where the i row and j column element of p is _ij and the R → R substitution function is s _j (x)

Is a substitution substitution method for obtaining a data string (y ₁ , y ₂ ,..., Y _m ) from an input data string (x ₁ , x ₂ ,..., X _n ),
A function that has the same value as any of the substitution functions s _j (x) by the cyclic shift is defined as s (x), a function in which a plurality of the functions s (x) are arranged is defined as SP (x), and this function SP (x when the) bit sequence obtained by substituting the possible values of x in the set to SP, the bit string SP may be stored in the memory,
A procedure in which the bit string extraction means extracts at least a part of the bit string SP from the memory;
The cyclic shift unit, the whole was extracted bit string by circulating shift, one of the substitution function s _j The result of substituting the input data x _j in _(x) s _{j (x j)} bit string to a plurality arranged SP _j A procedure for calculating (x _j );
The substitution method characterized by performing .   5. A substitution program for causing a computer to function as the substitution device according to claim 1.   A computer-readable substitution replacement recording medium storing the substitution substitution program according to claim 6.

Images